Privacy Policy

01Who is responsible

This policy covers the Juvo mobile app, playjuvo.app and the services that support them. The operator below is responsible for the personal data processed to provide Juvo (the data controller).

For privacy questions or a request about your data, contact nadja@lightly.care.

02Guest access and Apple accounts

You do not need to create an account to capture cars, use your free allowance, buy credits or subscribe. Guest access creates a random Juvo identifier and an installation credential. Our database stores a hash of that credential, session-token hashes, your allowance usage and credit records. These identifiers are pseudonymous, rather than fully anonymous.

If you choose Sign in with Apple, we verify Apple’s identity token and store the Apple identifier associated with Juvo, your Juvo account identifier and the verified email address Apple supplies. This may be an Apple private relay address. We do not receive your Apple password. Sign-in verification processes tokens, an authorization code and a one-time challenge. Apple authorization credentials needed to revoke access when an account is deleted are encrypted on our server.

Signing into a new account preserves the guest identity’s remaining balance. Signing into an existing account joins eligible paid purchases to that account; free guest credits remain with the guest identity. We use this association to avoid duplicate grants and protect ownership.

03Photos and AI processing

Camera access is used to photograph vehicles when you ask the app to capture one. Juvo does not request microphone or location access. Photos can incidentally contain people, licence plates or other personal information; please frame the vehicle carefully and avoid capturing identifiable people.

Scanning a vehicle starts a recognition request with OpenAI. Choosing Beautify starts an image-editing request with fal.ai and Google. Both features send the photo through private Cloudflare R2 storage. The app does not ask for a separate AI-sharing decision or store a new consent record before these requests. Reading or accepting the Terms of Service is not recorded as AI consent.

To avoid new AI submissions, do not start another scan or Beautify request. Processing already submitted may finish. Existing job results can be retrieved without sending a new photo. If recognition cannot identify a vehicle, you may add optional vehicle details before saving the photo.

Vehicle recognition

Your photo is uploaded to private Cloudflare R2 storage. A Juvo processing worker sends the image and vehicle-identification instructions to the OpenAI API. We process the returned make, model, specifications and other identification results, together with job timestamps and status, to show the result, manage your capture allowance and validate game rewards. Recognition can be incorrect.

Our recognition requests disable optional response storage. OpenAI states that API data is not used for model training by default; this does not mean that all provider logging or retention is disabled. Its abuse-monitoring and other applicable retention rules still apply. See OpenAI’s API data controls.

Beautify

When you choose Beautify, the source photo and image-editing instructions are sent to fal.ai, using Google’s Nano Banana 2 image model. fal.ai and Google process the image for this feature. The generated image is retrieved by our worker, stored privately in R2 and downloaded to your device. We retain the processing receipt and job status so interrupted jobs can recover and credits are charged only after a usable result is saved. See the model’s provider information.

AI providers and their relevant subprocessors may process inputs, outputs and technical request information under their applicable contracts and retention rules. We do not promise immediate deletion or that every downstream model provider has identical data practices. See fal.ai’s privacy policy and data-processing terms.

04Your garage and progress

Guest cars, photos, settings and game progress are stored locally on your device. Guest use of recognition, Beautify, allowances and purchases also creates the server records described in this policy; a locally stored garage does not make those features offline.

When you sign in, your guest captures and earned progress join that account’s garage. We synchronize capture identifiers, photos and originals, capture dates, vehicle details, previously saved corrections, AI results, XP history, challenge progress and synchronization revisions. Cloud photos are stored in private R2 storage; account and collection records are stored in our PostgreSQL database on the VPS.

Other devices signed into the same Juvo account can add their guest captures to that garage. Different captures remain separate; repeated progress rewards are not added twice. Synchronization runs while the app is open and connected. Offline changes may take time to appear on other devices.

Your garage is not a public feed. Signing out hides the account garage in the app but retains its local cache and pending changes for that account. Signing out does not delete the account or its cloud data.

05Purchases, credits and rewards

Apple processes App Store payments. Juvo does not receive your payment-card number or Apple payment credentials. RevenueCat manages store purchase verification and subscription entitlements and provides purchase reporting and subscription analytics.

Juvo and RevenueCat process the app-user identifiers associated with your purchase, product and transaction identifiers, purchase and renewal dates, store/environment information, subscription status, refunds and ownership transfers. Juvo keeps a server-side credit ledger, credit reservations, capture counts and reward-verification records. These records prevent duplicate rewards and support purchase recovery and refund corrections.

Restoring or transferring paid purchases does not grant access to a different Juvo account’s private garage. Apple and RevenueCat also process information under their own applicable policies: Apple and RevenueCat.

06Website, security and support

Our website and API are hosted by Vercel. Requests necessarily disclose technical connection information, such as IP addresses, requested URLs, request times, browser/device information and response or error status, to hosting providers. The VPS and processing worker also produce operational diagnostics.

We use technical records to deliver requests, troubleshoot failures, protect the service and enforce limits. Juvo does not currently integrate advertising SDKs, cross-app tracking, third-party product analytics or a dedicated crash-reporting SDK. The legal pages do not set advertising or analytics cookies.

The app stores local settings and authentication credentials needed to function. If you contact support, we process your contact details, message and any information you choose to send so we can respond. Please do not send passwords, payment-card details or private access keys.

07Why we process data

Where the GDPR applies, the following legal bases describe purposes other than sharing photos with AI providers:

• Providing the service — Article 6(1)(b): guest access, account sign-in, garage synchronization, purchases, credits and collection progress.
• Legitimate interests — Article 6(1)(f): securing the service, preventing repeated welcome grants or purchase fraud, maintaining reliable processing, reviewing subscription purchase reports and resolving support issues. We balance these interests against your rights; you may object to processing on this basis.
• Legal obligations — Article 6(1)(c): retaining records or responding to requests where applicable law requires it.

The legal basis for sharing personal data with AI providers has not been confirmed for the current flow. We do not represent a scan, a Beautify request or acceptance of the Terms of Service as data-protection consent.

Without the information required for a feature, we cannot provide that feature. You can use guest access without supplying an Apple identifier or email. AI recognition and Beautify require sending an image to the relevant providers. Juvo does not use your data for decisions producing legal or similarly significant effects about you.

08Who receives data

• Vercel: website/API hosting and technical request processing.
• VPS hosting infrastructure: our PostgreSQL database and processing worker, including guest/account records, job records, game records and credit accounting.
• Cloudflare R2: private storage and transfer of uploaded, generated and synchronized images.
• OpenAI: photos and instructions for vehicle recognition.
• fal.ai and Google, its current Beautify model provider: source photos, editing instructions and generated images for Beautify.
• Apple: Apple sign-in, App Store payments and subscription management.
• RevenueCat: app-user identifiers, purchase verification and reporting, subscription status and transfers.

We share data for these purposes, with authorized service providers and where required by law or necessary to protect legal rights. We do not sell your personal information or share it for cross-context behavioural advertising.

09International processing

Using Juvo can involve processing outside your country, including in the United States through hosting, AI and purchase providers and their subprocessors. A European database location alone does not keep all processing in Europe.

Where European data-protection law requires safeguards for a transfer, the applicable arrangement must provide a recognized basis, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, with additional measures where necessary. Contact nadja@lightly.care to request information about the safeguards applicable to your data.

10Retention and deletion

• Local data: photos and garage data remain in the app’s storage until removed. Removing the app can remove unsynchronized data. Credentials held in the operating system’s secure storage may survive reinstallation; uninstalling is not a server-side deletion request.
• Cloud garage: account collection data is retained to provide synchronization. Deleting a capture propagates its deletion and prevents stale devices from restoring that capture. Once no live capture refers to a cloud photo, the garage download API no longer provides it.
• Account and guest deletion: Profile → Account lets you initiate permanent deletion of an Apple-linked account or the current guest identity. After ownership verification and confirmation, we revoke sessions and remove account identifiers, Apple links, cloud garage/progress, processing payloads/results, upload records, mission data and recovery-device hashes from the active database. The app clears the deleted identity’s local cache. Other devices clear their cached account data when they next reconnect and learn that access has been revoked.
• Stored image files and Apple authorization: account deletion queues removal of the identity’s private R2 image files and revocation of Apple authorization, where applicable. Cleanup starts immediately and an additional image sweep is scheduled after 24 hours to catch uploads or processing already in flight. The deletion confirmation shows the scheduled cleanup time and whether cleanup is pending. Provider outages can delay physical cleanup; failed cleanup is retried. Deletion cannot recall copies already processed by an AI provider, whose applicable retention rules also apply.
• Identity, accounting and recovery records: account deletion removes the profile and free-credit records but retains a minimal, pseudonymous deletion marker and purchase/credit records necessary to reconcile paid transactions, refunds, duplicate-grant prevention and verified purchase recovery. An installation-credential hash without an account link also remains as an allowance marker, so deletion does not reset the one-time welcome grant or the current week’s usage; its weekly count is cleared after that week. These retained records are not a cloud garage or a usable sign-in account. Records required by law remain for the applicable legal period. We restrict retained records to those purposes; deletion does not erase Apple’s purchase records or RevenueCat’s independently required records.
• Provider records and backups: operational logs, provider-held copies and backups may have separate retention cycles. Erasure from active storage does not necessarily remove every backup immediately; copies retained for a lawful purpose remain protected.

Use the in-app deletion flow for account or guest-server deletion. An Apple-linked account requires a fresh Apple verification when necessary, so we can confirm ownership and revoke authorization. You can also contact nadja@lightly.care for access, erasure or a question about retained data. Include your Juvo account ID (Profile → Account) if available. We may ask for proportionate proof of ownership; never send your password or session token. Removing the app, signing out or deleting your Juvo account does not cancel an App Store subscription. The deletion flow offers Apple’s subscription settings so you can cancel renewal separately.

11Your choices and rights

You can revoke camera access in device Settings, remain a guest, sign out, delete captures or initiate account or guest-data deletion within the app. To avoid new AI photo submissions, do not start scans or Beautify requests. This does not remove photos or processing already submitted. If you do not want your guest photos synchronized, do not sign in to a Juvo account.

Depending on applicable law, you may request access, correction, erasure, restriction of processing or a portable copy of your data. You may object to processing based on legitimate interests and withdraw consent for consent-based processing without affecting earlier lawful processing. You may complain to a data-protection authority, including the authority in your place of residence, work or the alleged infringement.

Contact nadja@lightly.care to exercise these rights. We respond within the deadlines set by applicable law and explain any lawful limits on a request.

12Children and policy changes

Juvo is not designed for children. Users who cannot independently agree to the service under local law must involve a parent or guardian. If you believe a child has supplied personal data without the necessary authorization, contact us so we can investigate and handle it appropriately.

We update this policy when features or data practices change. The date above identifies the latest version. Material changes will be communicated as required by law. The Terms of Service describe the rules for using Juvo.